AmnesiaStealer cloned Chrome profile cookie export/re-encryption
Detects browser cookie theft via a cloned Chrome profile directory, CDP-based cookie export, and/or SQLite re-encryption of the cookie database using an attacker-known Safe Storage password, as used by AmnesiaStealer's streaming module.
Microsoft Sentinel (KQL)
